What is the CVSS score of CVE-2026-45635?

CVE-2026-45635 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Windows UPnP are affected by CVE-2026-45635?

A critical remote code execution vulnerability in Microsoft Windows Universal Plug and Play (UPnP) service affects all Windows systems with UPnP enabled, allowing unauthenticated network attackers to…. A patch is available.

How to fix or mitigate CVE-2026-45635?

Within 24 hours: Scan network for Windows systems with UPnP enabled (netsh advfirewall show allprofiles); document inventory. Within 7 days: If UPnP is not operationally required, disable via Services or Group Policy (Set-Service upnphost -StartupType Disabled); implement network segmentation to restrict UPnP traffic to trusted zones only; monitor Microsoft Security Response Center for patch availability. Within 30 days: Apply vendor-released patch immediately upon availability; validate remediation across all identified systems.

Windows UPnP CVE-2026-45635

EUVD-2026-35563 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-06-09 secure@microsoft.com

GHSA-7qjf-4x9r-9f46

Denial Of Service Memory Corruption Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

8.1

CVSS 3.1 · Vendor: microsoft

Temporal: 7.1

Severity by source

Vendor (microsoft) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

7.1 HIGH

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 19:03 EUVD

Analysis Generated

Jun 09, 2026 - 18:08 vuln.today

DescriptionCVE.org

Use after free in Universal Plug and Play (upnp.dll) allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in the Microsoft Windows Universal Plug and Play stack (upnp.dll) allows unauthenticated network attackers to execute arbitrary code on affected hosts by triggering a memory-safety flaw in the UPnP service. The issue carries a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N), reflecting network reachability without credentials but high attack complexity. At time of analysis there is no public exploit identified and the CVE is not listed in CISA KEV.

Technical ContextAI

UPnP is a set of networking protocols (built on SSDP, SOAP, and HTTPU/HTTPMU) that allow devices on a LAN to discover each other and negotiate services such as port forwarding and media sharing. On Windows, this functionality is implemented in upnp.dll, which is consumed by services including SSDP Discovery (SSDPSRV) and the UPnP Device Host (upnphost). The description identifies the root cause as a use-after-free condition, while the assigned CWE-843 (Access of Resource Using Incompatible Type / Type Confusion) points to memory being reinterpreted as the wrong object type - these often co-occur when a freed object is later dereferenced through a pointer expecting a different layout, allowing control of virtual dispatch or function pointers and culminating in code execution within the UPnP service context.

RemediationAI

Apply the Microsoft security update for CVE-2026-45635 once published per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45635 - patch status in the supplied data is 'Patch available per vendor advisory' with no exact KB cited here, so verify the specific KB for each Windows edition on MSRC before deployment. Where patching cannot be performed immediately, disable the SSDP Discovery (SSDPSRV) and UPnP Device Host (upnphost) services, which removes the vulnerable attack surface entirely at the cost of breaking media sharing, automatic device discovery on the LAN, and any application that relies on programmatic NAT port mapping. Additionally, block inbound SSDP (UDP/1900) and UPnP control traffic (typically TCP/2869 and TCP/5000) at host and perimeter firewalls and ensure UPnP is disabled on edge routers so the service is not reachable from untrusted networks; the trade-off is that some consumer gaming, VoIP, and IoT devices may need manual port forwarding configured.